Court: self-incrimination privilege won’t protect password

The privilege against self-incrimination, a federal court has ruled, does not …

A federal district court in Vermont has ruled that the Fifth Amendment right against self-incrimination does not bar the government from requiring Sebastien Boucher, who faces charges of possessing child pornography, to decrypt his laptop hard drive. A lower court had previously quashed a subpoena compelling Boucher to enter his password, reasoning that this was tantamount to requiring a defendant to testify against himself.

Boucher, a Canadian citizen who legally resides in the U.S., was stopped while returning to the country in 2006. Immigration officials searched his laptop at the border, and found thousands of image files that a border agent judged, on the basis of their file names, to be probable adult and child pornography. After viewing several images, border guards seized the laptop and shut it down—at which point Boucher's Pretty Good Privacy encryption kicked in, locking down the Z drive on which the files were contained.

Federal prosecutors initially sought a grand jury subpoena ordering Boucher to provide the password that would allow them to decrypt his hard drive. They later amended their request—presumably in hopes of avoiding Fifth Amendment concerns—clarifying that they would ask Boucher to enter the password himself in front of the grand jury. Despite this, a magistrate judge ruled in 2007 that the act of entering the password, even if the password itself was not disclosed to the government, was "testimonial" and therefore could not be compelled without offending the Fifth Amendment.

The author of the 2007 opinion, Judge Jerome Niedermeier, distinguished the order to enter the password from the superficially similar requirement that a defendant produce the key to a locked safe on the grounds that asking for the password was a demand that Boucher reveal the contents of his mind. Even though the password itself might not be incriminating, either disclosing or entering it would entail "implicit statements of fact, such as admitting that evidence exists, is authentic, or is within a suspect's control."

The government had sought to surmount Fifth Amendment barriers to its subpoena by stipulating that it would not use the fact of Boucher's knowledge of the password against him—prosecutors had ample evidence linking him to the laptop already, after all, not least his own admissions to the border guards. But Niedermeier would have none of it. Citing the 2000 case U.S. v. Hubbell, which disallowed the use of documents showing tax fraud against a defendant who had been granted immunity for the act of producing them (i.e. for demonstrating his knowledge of the documents). "The testimonial aspect of the entry of the password," wrote Niedermeier, "precludes the use of the files themselves as derivative of the compelled testimony."

Niedermeier similarly rejected the argument that the existence and location of the files—as opposed to their precise contents—was already known to the government, a "foregone conclusion." Since the files themselves are ordinary physical evidence, lacking any special protection, the privilege against self-incrimination applies only to the extent that the "testimony" of entering the password gives the government new information. "While the government has seen some of the files on drive Z, it has not viewed all or even most of them," Niedermeier reasoned. "While the government may know of the existence and location of the files it has previously viewed, it does not know of the existence of other files on drive Z that may contain incriminating material."

On February 19, however, Judge William Sessions reached a different conclusion. Though he did not directly address Niedermeier's Hubble analysis, Sessions accepted the "foregone conclusion" rationale, arguing that the lower court judge had erred in failing to distinguish between the contents of files on Boucher's Z drive and their existence and location.

The distinction here is fairly subtle, but the crucial legal point appears to be the interpretation of the "reasonable particularity" requirement that applies when government demands the "testimonial" production of evidence. Crudely put, the government can demand that you produce that bloody knife the police saw you run into the woods with, but they can't insist that you turn over any objects you may have around the house that would prove you guilty of a crime. In one case, they're just insisting that you provide the thing they intend to show the jury; in the other, you're supplying the information that helps them convict you.

Niedermeier reasoned that even if border guards had seen some of the files on the Z drive, prosecutors could not force Boucher to produce all the files on the drive. For Sessions, by contrast, the government's knowledge that it was after "the drive" constituted sufficient "particularity" that decrypting it merely gave prosecutors access to the specific contents of evidence they already knew about in reasonable detail.

It's a fuzzy enough distinction that Boucher's lawyers hope the next court up the ladder might land on the other side of it: they've already filed notice of their intention to appeal.